logo elektroda
logo elektroda
X

Teardown Action LSC SmartPlug 3202087 BK7231N/CB2S, PCB: WP02GE-F 2023-08-04, with Energy Meter

alvinx 3696 19
ADVERTISEMENT
📢 Listen (AI):
  • White Action LSC smart plug on a wooden surface.
    Action sells these in Germany, there are several versions of them, they started with ESP826x-based plugs and switched to Beken-chips at some point.
    The early ones had screws to open, the cases of the later ones like this here are just clicked together. Here is a detailed teardown and OpenBeken flashing guide. Device information:

    PCB-Label: WP02GE-F 2023-08-04
    BKN-Chip: BKN7231N
    BKN-Board: CB2S

    It looks like this:

    White smart plug with a button on the front side.
    White Action LSC smart plug on a wooden surface. Back view of a white smart plug. White electrical plug with certification markings on a wooden surface.

    To open it use a slim blade and put it about 5mm inside to pry it open:
    A smartplug on a wooden desk with a tool for opening it. A person opens the casing of a smart plug using a narrow blade.

    This is how it looks inside:
    Close-up view of a CB2S PCB with pin type labels on the Beken chip. Interior of a smart plug showing the PCB and components. Interior of a smartplug with components on a PCB Interior of a smart plug featuring BKN7231N chip on PCB WP02GE-F. Interior of a smart plug with a PCB labeled WP02GE-F 2023-08-04. Interior of a smart plug with exposed PCB and electronic components. Opened smart plug showing electronic components on the PCB. Interior view of a smart plug with connected wires.

    Here's the pinout of the CB2S-Board:
    Diagram showing the pin layout on the CB2S board. Diagram of CB2S board with pin labels and dimensions.

    To flash it we need to connect our FTDI-USB-Programmer to the pins 3,3V, GND, RX, TX and a Cable to CEN (so that we can connect that to GND to get into program mode).
    I soldered some Dupont-Cables to these pins, like this:
    Close-up of a circuit board with cables connected to a programmer. FTDI-USB module with attached Dupont cables. Close-up of the interior of a smart plug with several wires soldered to the pins on the PCB. CB2S motherboard with connected Dupont cables.
    It's not pretty but it works and it's just temporary, I desolder these after flashing anyway.


    My FTDI-USB-Programmer is set to 3,3V via Jumper and I connected it like this:
    FTDI CB2S
    VCC 3,3V
    GND GND
    RX TX
    TX RX

    and a loose cable to CEN of the CB2S... we need to short it to GND later to start flashing.

    I used the GUI BKN-Flashtool from here: https://github.com/openshwprojects/BK7231GUIFlashTool

    Connect your FTDI-USB-Programmer to your PC and start the flash-Tool:
    BK7231N flasher tool interface with open log window.
    select the following:
    - the correct COM-Port, here it is COM4
    - the chip type, CB2S uses BK7231N
    - the firmware you want to flash, you can download the latest Firmware with the Button "Download latest from Web", which I did ... you can get Firmwares from here too: https://github.com/openshwprojects/OpenBK7231T_App/releases and put them in the firmwares-folder of the flash-Tool
    I did not change anything else.

    Now you can do a backup of the firmware which I highly recommend because you get the GPIO-pins the plug is using, which need to be configured later for it to work properly !
    So click "Do firmware backup (read) only"... it looks like in the above screenshot... now touch very briefly the loose cable from CEN to the GND pin and the backup should start, it looks like that:
    Screenshot of BK7231 Easy UART Flasher showing successful reading.

    after that is finished successfully you get this window showing the extracted GPIO-config:
    Screenshot of Tuya device GPIO configuration.
    Copy and paste this information into a text editor, we need that later !

    Now we flash the OpenBeken-Firmware, click "Do firmware write (no backup)" ...
    now again touch very briefly the loose cable from CEN to the GND pin and it should start flashing:
    Screenshot of the BK7231 Easy UART Flasher application during firmware flashing.
    Screenshot of BK7231 Easy UART Flasher tool with Write success! message.

    Congrats, we have successfully flashed OpenBeken !

    We still power it from th FTDI-Programmer via USB.

    Now connect to the AccessPoint that is created:
    Smartphone screen displaying the OpenBK7231N_5055331E Wi-Fi network.

    and open 192.168.4.1 in your webrowser to get to the OpenBeken-WebUI:
    Screenshot of the OpenBK7231N interface on the configuration page.
    There is no ON/OFF-Button yet, because we have to configure the correct pins for the relay, butten and led first.

    click on "Config" and you get to this page:
    OpenBeken configuration panel on a mobile device

    Then click on "Configure WiFi & Web" to connect it to your Wifi-network, should be self explanatory, I won't go into detail here.

    After that the chip will connect to your Wifi and get an IP-address via DHCP, so look in your router's WebUI which IP it uses now.
    Then connect to your Wifi and open the new IP in your webbrowser.

    Now it's time to remove the soldered cables by desoldering them, after that check if your solder connections to the CB2S-board are still good and not shorted or so !
    Put everything back into the plug-case and close it correctly by pushing the two halves together again.
    You can plug it into mains now and power it from there... reconnect via webbrowser again to finish the configuration...

    I switch to my PC now, so the screenshots are bigger from here on...
    click on "Configure Module" to setup GPIO pins, we got the following info extracted before after doing the backup:
    -----------------------
    Device configuration, as extracted from Tuya:
    - BL0937 SEL on P11
    - Button (channel 1) on P7
    - LED (channel 1) on P6
    - BL0937 VI on P24
    - WiFi LED on P10
    - BL0937 ELE on P26
    - Relay (channel 1) on P8
    Device seems to be using CB2S module, which is using BK7231N.
    And the Tuya section starts, as usual, at 2023424
    -----------------------
    That translates to this:
    Screenshot of OpenBK7231N interface showing the pin configuration for CB2S.

    I gave my plug a better name in "Config" -> "Configure Names", especially to use it in Home Assistant later under that name, I choose f.e. "bkn_lsc_plug1".

    After that you can go back to "home" and you should see a ON/OFF-toggle to switch the plug, hope it works !
    OpenBeken user interface screen displaying information about the bkn_lsc_plug1 plug.

    Additional information:
    You should see energy metering information too, but that needs to be calibrated first, go to http://<your-ip-address>/app and then "Tools" for that.
    See here for more on that: https://www.elektroda.com/rtvforum/topic4030107.html

    To get energy statistics you need to add NTP time sync by adding "startDriver NTP" to your autoexec.bat, needs to be created via http://<your-ip-address>/app under "Filesystem".
    Do your research how to setup an autoexec.bat-file which gets executed at boottime of the plug, video here: https://www.youtube.com/watch?v=kXi8S12tmC8

    Here is my autoexec.bat:

    //start NTP driver
    startDriver NTP
    
    //timezone +1 (add one hour to UTC time)
    ntp_timeZoneOfs 1
    
    // Setting the devices location will allow for calculating sunrise and sunset times
    // put your GPS latitude and longitude here with 6 digits after the comma, not sure if more digits work
    //ntp_setLatlong <latitude>, <longitude>
    
    //enable powersaving
    //PowerSave 1
    //EDIT: I disabled PowerSave after this comment from p.kaczmarek2:
    //- I advise you to be careful with "PowerSave" with the BL0937, 
    //  because the BL0937 requires precise pulse/interrupt counting and potentially "PowerSave" can reduce the precision. 
    //  With the BL0942 this problem does not occur.
    
    
    //wait for NTP to connect
    waitFor NTPState 1



    Do your research on how to add your Openbeken-device to Home Assistant, here's a video: https://www.youtube.com/watch?v=pkcspey25V4


    I hope you enjoy this Teardown and HowTo and that it help some people... have a great day !

    btw. I really like OpenBeken, very well done with sooo many options, thank you to the OpenBeken-developers !


    EDIT:
    Here's my template from the /app-WebUI + some information added:
    {
      "vendor": "Action LSC",
      "bDetailed": "0",
      "name": "Action LSC Smartplug",
      "model": "3202087 2023-08-04",
      "chip": "BK7231N",
      "board": "CB2S",
      "flags": "1024",
      "keywords": [
        "lsc",
        "smartplug",
       "energymeter",
       "CB2S",
        "BK7231N"
      ],
      "pins": {
        "6": "LED;0",
        "7": "Btn;0",
        "8": "Rel;0",
        "10": "WifiLED;0",
        "11": "BL0937SEL;0",
        "24": "BL0937CF1;0",
        "26": "BL0937CF;0"
      },
      "command": "",
      "image": "https://obrazki.elektroda.pl/7456543000_1731711564.jpg",
      "wiki": "hhttps://www.elektroda.com/rtvforum/viewtopic.php?p=21305004#21305004"
    }

    Cool? Ranking DIY
    About Author
    alvinx
    Level 2  
    Offline 
    alvinx wrote 2 posts with rating 8, helped 1 times. Been with us since 2024 year.
  • ADVERTISEMENT
  • #2 21305208
    p.kaczmarek2
    Moderator Smart Home
    Thank you for the detailed description! I will only add my comments:
    - I advise you to be careful with "PowerSave" with the BL0937, because the BL0937 requires precise pulse/interrupt counting and potentially "PowerSave" can reduce the precision. With the BL0942 this problem does not occur
    - I personally prefer to desolder the CB2S and flash it off-chip: https://www.youtube.com/watch?v=YQdR7r6lXRY . RESET via CEN can sometimes be problematic.
    Helpful post? Buy me a coffee.
  • #3 21305617
    alvinx
    Level 2  
    Thank you very much for your knowledge.

    I will delete PowerSave in my autoexec.bat then.
  • #4 21330471
    irekhq
    Level 13  
    Device as per topic.
    Firmware uploaded:
    Build: Built on Dec 1 2024 12:26:58 version 1.17.782
    Everything works correctly, only I can not change the version via OTA, it always starts with version 782
    
    Info:OTA:init OTA, startaddr 0x12a000
    Info:OTA:12a000
    Info:OTA:12b000
    ...
    Info:OTA:close OTA, additional 0xb00 FF added 
    Info:OTA:1a5000
    Info:OTA:close OTA, addr 0x1a5400
    Info:MAIN:Module reboot in 2...
    Info:MAIN:Module reboot in 1...
    Info:MAIN:Main_Init_Before_Delay
    Info:CFG:####### Boot Count 48 #######
    Warn:CFG:CFG_InitAndLoad: Correct config has been loaded with 10 changes count.
    Error:CMD:no file early.bat err -2
    Info:EnergyMeter:Read ENERGYMETER status values. sizeof(ENERGY_METERING_DATA)=32
    Info:MAIN:Started BL0937.
    Info:GEN:PIN_SetupPins pins have been set up.
    Info:MAIN:Main_Init_Before_Delay done
    Info:MAIN:Main_Init_Delay
    Info:MAIN:Main_Init_Delay done
    Info:MAIN:Main_Init_After_Delay
    ...
    Info:MAIN:Boot complete time reached (5 seconds)
    Info:CFG:####### Set Boot Complete #######
    
    .
    What am I doing wrong ?
  • #5 21330478
    p.kaczmarek2
    Moderator Smart Home
    Just to be sure - what file are you giving to the OTA and where?
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #6 21330487
    irekhq
    Level 13  
    I enter via /app? , I select the OTA tab.
    From the list "Select remote OTA file to download to PC:", I select for example the latest firmware OpenBK7231N_1.17.788.rbl.
    In "Select OTA file from disk:", I select the previously downloaded firmware.
    I click "Start OTA"
  • #8 21692789
    tos18
    Level 42  
    Hello
    Can I ask for the values of C5,C7,C8 and R11

    Close-up of PCB with damaged components C5, C7, C8, and R11 marked .
    Unfortunately disassembly of the chassis took place with unplanned losses.
  • ADVERTISEMENT
  • #9 21692833
    p.kaczmarek2
    Moderator Smart Home
    What IC is sitting there? Is it a BL0937 or a power supply chip?
    Helpful post? Buy me a coffee.
  • #10 21692874
    jaboto
    Level 3  
    Hello, I am new here :)

    I bough yesterday one of this devices in Action Belgium, came home and started flashing after finding this forum. I cannot make it work. I managed to read the firmware and I can write (it seems according to the logs) but I cannot get the Access Point. If I connect the plug to a wall socket I see no light. Also, with the USB connected, I see the light but the WiFi doesn't show up.

    I first flashed without dismantling the CB2S module. Then, because I wanted to read the type of BK7321X I had I desoldered it and flashed again. Finally I have remounted and flashed again. These operations, all, seem to work.

    Teardown Action LSC SmartPlug 3202087 BK7231N/CB2S, PCB: WP02GE-F 2023-08-04, with Energy Meter
    Teardown Action LSC SmartPlug 3202087 BK7231N/CB2S, PCB: WP02GE-F 2023-08-04, with Energy Meter
    Teardown Action LSC SmartPlug 3202087 BK7231N/CB2S, PCB: WP02GE-F 2023-08-04, with Energy Meter
    Teardown Action LSC SmartPlug 3202087 BK7231N/CB2S, PCB: WP02GE-F 2023-08-04, with Energy Meter

    Logs:
    
    Starting flash new (no backup)!
    Now is: Wednesday, September 17, 2025 4:44:37 PM.
    Flasher mode: BK7231N
    Going to open port: /dev/ttyUSB0.
    Serial port open!
    Getting bus... (now, please do reboot by CEN or by power off/on)
    Getting bus success!
    Going to set baud rate setting (460800)!
    Will try to read device flash MID (for unprotect N):
    Flash MID loaded: 1560EB
    Will now search for Flash def in out database...
    Flash def found! For: 1560EB
    Flash information: mid: 1560EB, icName: TH25Q16HB, manufacturer: TH, szMem: 1000000, szSR: 2, cwUnp: 0, cwEnp: 7, cwMsk: 407C, sb: 2, lb: 5, cwdRd: 05-35-FF-FF, cwdWr: 01-FF-FF-FF
    Entering SetProtectState(True)...
    sr: 0
    sr: 0
    final sr: 0
    msk: 407c
    cw: 0, sb: 2, lb: 5
    bfd: 0
    SetProtectState(True) success!
    Going to read encryption key...
    Encryption key read done!
    Encryption key: 510fb093 a3cbeadc 5993a17e c7adeb03
    Reading file firmwares/OpenBK7231N_QIO_1.18.175.bin...
    Loaded 1220464 bytes from firmwares/OpenBK7231N_QIO_1.18.175.bin...
    Using hack to write QIO - just skip bootloader...
    ... so bootloader will not be overwritten!
    Preparing to write data file to chip - resetting bus and baud...
    Getting bus... (now, please do reboot by CEN or by power off/on)
    Getting bus success!
    Going to set baud rate setting (460800)!
    Will try to read device flash MID (for unprotect N):
    Flash MID loaded: 1560EB
    Will now search for Flash def in out database...
    Flash def found! For: 1560EB
    Flash information: mid: 1560EB, icName: TH25Q16HB, manufacturer: TH, szMem: 1000000, szSR: 2, cwUnp: 0, cwEnp: 7, cwMsk: 407C, sb: 2, lb: 5, cwdRd: 05-35-FF-FF, cwdWr: 01-FF-FF-FF
    Entering SetProtectState(True)...
    sr: 0
    sr: 0
    final sr: 0
    msk: 407c
    cw: 0, sb: 2, lb: 5
    bfd: 0
    SetProtectState(True) success!
    Going to do erase, start 69632, sec count 281!
    Erasing sector 69632... ok! Erasing sector 73728... ok! Erasing sector 77824... ok! Erasing sector 81920... ok! Erasing sector 86016... ok! Erasing sector 90112... ok! Erasing sector 94208... ok! Erasing sector 98304... ok! Erasing sector 102400... ok! Erasing sector 106496... ok! Erasing sector 110592... ok! Erasing sector 114688... ok! Erasing sector 118784... ok! Erasing sector 122880... ok! Erasing sector 126976... ok! Erasing sector 131072... ok! Erasing sector 135168... ok! Erasing sector 139264... ok! Erasing sector 143360... ok! Erasing sector 147456... ok! Erasing sector 151552... ok! Erasing sector 155648... ok! Erasing sector 159744... ok! Erasing sector 163840... ok! Erasing sector 167936... ok! Erasing sector 172032... ok! Erasing sector 176128... ok! Erasing sector 180224... ok! Erasing sector 184320... ok! Erasing sector 188416... ok! Erasing sector 192512... ok! Erasing sector 196608... ok! Erasing sector 200704... ok! Erasing sector 204800... ok! Erasing sector 208896... ok! Erasing sector 212992... ok! Erasing sector 217088... ok! Erasing sector 221184... ok! Erasing sector 225280... ok! Erasing sector 229376... ok! Erasing sector 233472... ok! Erasing sector 237568... ok! Erasing sector 241664... ok! Erasing sector 245760... ok! Erasing sector 249856... ok! Erasing sector 253952... ok! Erasing sector 258048... ok! Erasing sector 262144... ok! Erasing sector 266240... ok! Erasing sector 270336... ok! Erasing sector 274432... ok! Erasing sector 278528... ok! Erasing sector 282624... ok! Erasing sector 286720... ok! Erasing sector 290816... ok! Erasing sector 294912... ok! Erasing sector 299008... ok! Erasing sector 303104... ok! Erasing sector 307200... ok! Erasing sector 311296... ok! Erasing sector 315392... ok! Erasing sector 319488... ok! Erasing sector 323584... ok! Erasing sector 327680... ok! Erasing sector 331776... ok! Erasing sector 335872... ok! Erasing sector 339968... ok! Erasing sector 344064... ok! Erasing sector 348160... ok! Erasing sector 352256... ok! Erasing sector 356352... ok! Erasing sector 360448... ok! Erasing sector 364544... ok! Erasing sector 368640... ok! Erasing sector 372736... ok! Erasing sector 376832... ok! Erasing sector 380928... ok! Erasing sector 385024... ok! Erasing sector 389120... ok! Erasing sector 393216... ok! Erasing sector 397312... ok! Erasing sector 401408... ok! Erasing sector 405504... ok! Erasing sector 409600... ok! Erasing sector 413696... ok! Erasing sector 417792... ok! Erasing sector 421888... ok! Erasing sector 425984... ok! Erasing sector 430080... ok! Erasing sector 434176... ok! Erasing sector 438272... ok! Erasing sector 442368... ok! Erasing sector 446464... ok! Erasing sector 450560... ok! Erasing sector 454656... ok! Erasing sector 458752... ok! Erasing sector 462848... ok! Erasing sector 466944... ok! Erasing sector 471040... ok! Erasing sector 475136... ok! Erasing sector 479232... ok! Erasing sector 483328... ok! Erasing sector 487424... ok! Erasing sector 491520... ok! Erasing sector 495616... ok! Erasing sector 499712... ok! Erasing sector 503808... ok! Erasing sector 507904... ok! Erasing sector 512000... ok! Erasing sector 516096... ok! Erasing sector 520192... ok! Erasing sector 524288... ok! Erasing sector 528384... ok! Erasing sector 532480... ok! Erasing sector 536576... ok! Erasing sector 540672... ok! Erasing sector 544768... ok! Erasing sector 548864... ok! Erasing sector 552960... ok! Erasing sector 557056... ok! Erasing sector 561152... ok! Erasing sector 565248... ok! Erasing sector 569344... ok! Erasing sector 573440... ok! Erasing sector 577536... ok! Erasing sector 581632... ok! Erasing sector 585728... ok! Erasing sector 589824... ok! Erasing sector 593920... ok! Erasing sector 598016... ok! Erasing sector 602112... ok! Erasing sector 606208... ok! Erasing sector 610304... ok! Erasing sector 614400... ok! Erasing sector 618496... ok! Erasing sector 622592... ok! Erasing sector 626688... ok! Erasing sector 630784... ok! Erasing sector 634880... ok! Erasing sector 638976... ok! Erasing sector 643072... ok! Erasing sector 647168... ok! Erasing sector 651264... ok! Erasing sector 655360... ok! Erasing sector 659456... ok! Erasing sector 663552... ok! Erasing sector 667648... ok! Erasing sector 671744... ok! Erasing sector 675840... ok! Erasing sector 679936... ok! Erasing sector 684032... ok! Erasing sector 688128... ok! Erasing sector 692224... ok! Erasing sector 696320... ok! Erasing sector 700416... ok! Erasing sector 704512... ok! Erasing sector 708608... ok! Erasing sector 712704... ok! Erasing sector 716800... ok! Erasing sector 720896... ok! Erasing sector 724992... ok! Erasing sector 729088... ok! Erasing sector 733184... ok! Erasing sector 737280... ok! Erasing sector 741376... ok! Erasing sector 745472... ok! Erasing sector 749568... ok! Erasing sector 753664... ok! Erasing sector 757760... ok! Erasing sector 761856... ok! Erasing sector 765952... ok! Erasing sector 770048... ok! Erasing sector 774144... ok! Erasing sector 778240... ok! Erasing sector 782336... ok! Erasing sector 786432... ok! Erasing sector 790528... ok! Erasing sector 794624... ok! Erasing sector 798720... ok! Erasing sector 802816... ok! Erasing sector 806912... ok! Erasing sector 811008... ok! Erasing sector 815104... ok! Erasing sector 819200... ok! Erasing sector 823296... ok! Erasing sector 827392... ok! Erasing sector 831488... ok! Erasing sector 835584... ok! Erasing sector 839680... ok! Erasing sector 843776... ok! Erasing sector 847872... ok! Erasing sector 851968... ok! Erasing sector 856064... ok! Erasing sector 860160... ok! Erasing sector 864256... ok! Erasing sector 868352... ok! Erasing sector 872448... ok! Erasing sector 876544... ok! Erasing sector 880640... ok! Erasing sector 884736... ok! Erasing sector 888832... ok! Erasing sector 892928... ok! Erasing sector 897024... ok! Erasing sector 901120... ok! Erasing sector 905216... ok! Erasing sector 909312... ok! Erasing sector 913408... ok! Erasing sector 917504... ok! Erasing sector 921600... ok! Erasing sector 925696... ok! Erasing sector 929792... ok! Erasing sector 933888... ok! Erasing sector 937984... ok! Erasing sector 942080... ok! Erasing sector 946176... ok! Erasing sector 950272... ok! Erasing sector 954368... ok! Erasing sector 958464... ok! Erasing sector 962560... ok! Erasing sector 966656... ok! Erasing sector 970752... ok! Erasing sector 974848... ok! Erasing sector 978944... ok! Erasing sector 983040... ok! Erasing sector 987136... ok! Erasing sector 991232... ok! Erasing sector 995328... ok! Erasing sector 999424... ok! Erasing sector 1003520... ok! Erasing sector 1007616... ok! Erasing sector 1011712... ok! Erasing sector 1015808... ok! Erasing sector 1019904... ok! Erasing sector 1024000... ok! Erasing sector 1028096... ok! Erasing sector 1032192... ok! Erasing sector 1036288... ok! Erasing sector 1040384... ok! Erasing sector 1044480... ok! Erasing sector 1048576... ok! Erasing sector 1052672... ok! Erasing sector 1056768... ok! Erasing sector 1060864... ok! Erasing sector 1064960... ok! Erasing sector 1069056... ok! Erasing sector 1073152... ok! Erasing sector 1077248... ok! Erasing sector 1081344... ok! Erasing sector 1085440... ok! Erasing sector 1089536... ok! Erasing sector 1093632... ok! Erasing sector 1097728... ok! Erasing sector 1101824... ok! Erasing sector 1105920... ok! Erasing sector 1110016... ok! Erasing sector 1114112... ok! Erasing sector 1118208... ok! Erasing sector 1122304... ok! Erasing sector 1126400... ok! Erasing sector 1130496... ok! Erasing sector 1134592... ok! Erasing sector 1138688... ok! Erasing sector 1142784... ok! Erasing sector 1146880... ok! Erasing sector 1150976... ok! Erasing sector 1155072... ok! Erasing sector 1159168... ok! Erasing sector 1163264... ok! Erasing sector 1167360... ok! Erasing sector 1171456... ok! Erasing sector 1175552... ok! Erasing sector 1179648... ok! Erasing sector 1183744... ok! Erasing sector 1187840... ok! Erasing sector 1191936... ok! Erasing sector 1196032... ok! Erasing sector 1200128... ok! Erasing sector 1204224... ok! Erasing sector 1208320... ok! Erasing sector 1212416... ok! Erasing sector 1216512... ok!
    All selected sectors erased!
    Writing sector 0x11000... ok! Writing sector 0x12000... ok! Writing sector 0x13000... ok! Writing sector 0x14000... ok! Writing sector 0x15000... ok! Writing sector 0x16000... ok! Writing sector 0x17000... ok! Writing sector 0x18000... ok! Writing sector 0x19000... ok! Writing sector 0x1A000... ok! Writing sector 0x1B000... ok! Writing sector 0x1C000... ok! Writing sector 0x1D000... ok! Writing sector 0x1E000... ok! Writing sector 0x1F000... ok! Writing sector 0x20000... ok! Writing sector 0x21000... ok! Writing sector 0x22000... ok! Writing sector 0x23000... ok! Writing sector 0x24000... ok! Writing sector 0x25000... ok! Writing sector 0x26000... ok! Writing sector 0x27000... ok! Writing sector 0x28000... ok! Writing sector 0x29000... ok! Writing sector 0x2A000... ok! Writing sector 0x2B000... ok! Writing sector 0x2C000... ok! Writing sector 0x2D000... ok! Writing sector 0x2E000... ok! Writing sector 0x2F000... ok! Writing sector 0x30000... ok! Writing sector 0x31000... ok! Writing sector 0x32000... ok! Writing sector 0x33000... ok! Writing sector 0x34000... ok! Writing sector 0x35000... ok! Writing sector 0x36000... ok! Writing sector 0x37000... ok! Writing sector 0x38000... ok! Writing sector 0x39000... ok! Writing sector 0x3A000... ok! Writing sector 0x3B000... ok! Writing sector 0x3C000... ok! Writing sector 0x3D000... ok! Writing sector 0x3E000... ok! Writing sector 0x3F000... ok! Writing sector 0x40000... ok! Writing sector 0x41000... ok! Writing sector 0x42000... ok! Writing sector 0x43000... ok! Writing sector 0x44000... ok! Writing sector 0x45000... ok! Writing sector 0x46000... ok! Writing sector 0x47000... ok! Writing sector 0x48000... ok! Writing sector 0x49000... ok! Writing sector 0x4A000... ok! Writing sector 0x4B000... ok! Writing sector 0x4C000... ok! Writing sector 0x4D000... ok! Writing sector 0x4E000... ok! Writing sector 0x4F000... ok! Writing sector 0x50000... ok! Writing sector 0x51000... ok! Writing sector 0x52000... ok! Writing sector 0x53000... ok! Writing sector 0x54000... ok! Writing sector 0x55000... ok! Writing sector 0x56000... ok! Writing sector 0x57000... ok! Writing sector 0x58000... ok! Writing sector 0x59000... ok! Writing sector 0x5A000... ok! Writing sector 0x5B000... ok! Writing sector 0x5C000... ok! Writing sector 0x5D000... ok! Writing sector 0x5E000... ok! Writing sector 0x5F000... ok! Writing sector 0x60000... ok! Writing sector 0x61000... ok! Writing sector 0x62000... ok! Writing sector 0x63000... ok! Writing sector 0x64000... ok! Writing sector 0x65000... ok! Writing sector 0x66000... ok! Writing sector 0x67000... ok! Writing sector 0x68000... ok! Writing sector 0x69000... ok! Writing sector 0x6A000... ok! Writing sector 0x6B000... ok! Writing sector 0x6C000... ok! Writing sector 0x6D000... ok! Writing sector 0x6E000... ok! Writing sector 0x6F000... ok! Writing sector 0x70000... ok! Writing sector 0x71000... ok! Writing sector 0x72000... ok! Writing sector 0x73000... ok! Writing sector 0x74000... ok! Writing sector 0x75000... ok! Writing sector 0x76000... ok! Writing sector 0x77000... ok! Writing sector 0x78000... ok! Writing sector 0x79000... ok! Writing sector 0x7A000... ok! Writing sector 0x7B000... ok! Writing sector 0x7C000... ok! Writing sector 0x7D000... ok! Writing sector 0x7E000... ok! Writing sector 0x7F000... ok! Writing sector 0x80000... ok! Writing sector 0x81000... ok! Writing sector 0x82000... ok! Writing sector 0x83000... ok! Writing sector 0x84000... ok! Writing sector 0x85000... ok! Writing sector 0x86000... ok! Writing sector 0x87000... ok! Writing sector 0x88000... ok! Writing sector 0x89000... ok! Writing sector 0x8A000... ok! Writing sector 0x8B000... ok! Writing sector 0x8C000... ok! Writing sector 0x8D000... ok! Writing sector 0x8E000... ok! Writing sector 0x8F000... ok! Writing sector 0x90000... ok! Writing sector 0x91000... ok! Writing sector 0x92000... ok! Writing sector 0x93000... ok! Writing sector 0x94000... ok! Writing sector 0x95000... ok! Writing sector 0x96000... ok! Writing sector 0x97000... ok! Writing sector 0x98000... ok! Writing sector 0x99000... ok! Writing sector 0x9A000... ok! Writing sector 0x9B000... ok! Writing sector 0x9C000... ok! Writing sector 0x9D000... ok! Writing sector 0x9E000... ok! Writing sector 0x9F000... ok! Writing sector 0xA0000... ok! Writing sector 0xA1000... ok! Writing sector 0xA2000... ok! Writing sector 0xA3000... ok! Writing sector 0xA4000... ok! Writing sector 0xA5000... ok! Writing sector 0xA6000... ok! Writing sector 0xA7000... ok! Writing sector 0xA8000... ok! Writing sector 0xA9000... ok! Writing sector 0xAA000... ok! Writing sector 0xAB000... ok! Writing sector 0xAC000... ok! Writing sector 0xAD000... ok! Writing sector 0xAE000... ok! Writing sector 0xAF000... ok! Writing sector 0xB0000... ok! Writing sector 0xB1000... ok! Writing sector 0xB2000... ok! Writing sector 0xB3000... ok! Writing sector 0xB4000... ok! Writing sector 0xB5000... ok! Writing sector 0xB6000... ok! Writing sector 0xB7000... ok! Writing sector 0xB8000... ok! Writing sector 0xB9000... ok! Writing sector 0xBA000... ok! Writing sector 0xBB000... ok! Writing sector 0xBC000... ok! Writing sector 0xBD000... ok! Writing sector 0xBE000... ok! Writing sector 0xBF000... ok! Writing sector 0xC0000... ok! Writing sector 0xC1000... ok! Writing sector 0xC2000... ok! Writing sector 0xC3000... ok! Writing sector 0xC4000... ok! Writing sector 0xC5000... ok! Writing sector 0xC6000... ok! Writing sector 0xC7000... ok! Writing sector 0xC8000... ok! Writing sector 0xC9000... ok! Writing sector 0xCA000... ok! Writing sector 0xCB000... ok! Writing sector 0xCC000... ok! Writing sector 0xCD000... ok! Writing sector 0xCE000... ok! Writing sector 0xCF000... ok! Writing sector 0xD0000... ok! Writing sector 0xD1000... ok! Writing sector 0xD2000... ok! Writing sector 0xD3000... ok! Writing sector 0xD4000... ok! Writing sector 0xD5000... ok! Writing sector 0xD6000... ok! Writing sector 0xD7000... ok! Writing sector 0xD8000... ok! Writing sector 0xD9000... ok! Writing sector 0xDA000... ok! Writing sector 0xDB000... ok! Writing sector 0xDC000... ok! Writing sector 0xDD000... ok! Writing sector 0xDE000... ok! Writing sector 0xDF000... ok! Writing sector 0xE0000... ok! Writing sector 0xE1000... ok! Writing sector 0xE2000... ok! Writing sector 0xE3000... ok! Writing sector 0xE4000... ok! Writing sector 0xE5000... ok! Writing sector 0xE6000... ok! Writing sector 0xE7000... ok! Writing sector 0xE8000... ok! Writing sector 0xE9000... ok! Writing sector 0xEA000... ok! Writing sector 0xEB000... ok! Writing sector 0xEC000... ok! Writing sector 0xED000... ok! Writing sector 0xEE000... ok! Writing sector 0xEF000... ok! Writing sector 0xF0000... ok! Writing sector 0xF1000... ok! Writing sector 0xF2000... ok! Writing sector 0xF3000... ok! Writing sector 0xF4000... ok! Writing sector 0xF5000... ok! Writing sector 0xF6000... ok! Writing sector 0xF7000... ok! Writing sector 0xF8000... ok! Writing sector 0xF9000... ok! Writing sector 0xFA000... ok! Writing sector 0xFB000... ok! Writing sector 0xFC000... ok! Writing sector 0xFD000... ok! Writing sector 0xFE000... ok! Writing sector 0xFF000... ok! Writing sector 0x100000... ok! Writing sector 0x101000... ok! Writing sector 0x102000... ok! Writing sector 0x103000... ok! Writing sector 0x104000... ok! Writing sector 0x105000... ok! Writing sector 0x106000... ok! Writing sector 0x107000... ok! Writing sector 0x108000... ok! Writing sector 0x109000... ok! Writing sector 0x10A000... ok! Writing sector 0x10B000... ok! Writing sector 0x10C000... ok! Writing sector 0x10D000... ok! Writing sector 0x10E000... ok! Writing sector 0x10F000... ok! Writing sector 0x110000... ok! Writing sector 0x111000... ok! Writing sector 0x112000... ok! Writing sector 0x113000... ok! Writing sector 0x114000... ok! Writing sector 0x115000... ok! Writing sector 0x116000... ok! Writing sector 0x117000... ok! Writing sector 0x118000... ok! Writing sector 0x119000... ok! Writing sector 0x11A000... ok! Writing sector 0x11B000... ok! Writing sector 0x11C000... ok! Writing sector 0x11D000... ok! Writing sector 0x11E000... ok! Writing sector 0x11F000... ok! Writing sector 0x120000... ok! Writing sector 0x121000... ok! Writing sector 0x122000... ok! Writing sector 0x123000... ok! Writing sector 0x124000... ok! Writing sector 0x125000... ok! Writing sector 0x126000... ok! Writing sector 0x127000... ok! Writing sector 0x128000... ok! Writing sector 0x129000... ok! Starting CRC check for 281 sectors, starting at offset 0x11000
    CRC matches 0x53B41C4D!
    
    NOTE: the OBK config writing is disabled, so not writing anything extra.
    Writing file data to chip successs.
    


    Writing OBK config log:
    
    Tuya config extractor - magic is at 2023424 
    Saving debug Tuya decryption data to lastRawDecryptedStrings.bin
    Tuya keys extraction has found 32 keys
    It's not an OBK config, header is bad
    Failed to extract Tuya keys - magic constant header not found in binary
    It's not an OBK config, header is bad
    Tuya config extractor - magic is at 2023424 
    Saving debug Tuya decryption data to lastRawDecryptedStrings.bin
    Tuya keys extraction has found 32 keys
    
    Starting write only OBK config!
    Now is: Wednesday, September 17, 2025 5:14:56 PM.
    Flasher mode: BK7231N
    Going to open port: /dev/ttyUSB0.
    Serial port open!
    Getting bus... (now, please do reboot by CEN or by power off/on)
    Getting bus failed, will try again - 0/100!
    Getting bus failed, will try again - 1/100!
    Getting bus success!
    Going to set baud rate setting (460800)!
    Will try to read device flash MID (for unprotect N):
    Flash MID loaded: 1560EB
    Will now search for Flash def in out database...
    Flash def found! For: 1560EB
    Flash information: mid: 1560EB, icName: TH25Q16HB, manufacturer: TH, szMem: 1000000, szSR: 2, cwUnp: 0, cwEnp: 7, cwMsk: 407C, sb: 2, lb: 5, cwdRd: 05-35-FF-FF, cwdWr: 01-FF-FF-FF
    Entering SetProtectState(True)...
    sr: 0
    sr: 0
    final sr: 0
    msk: 407c
    cw: 0, sb: 2, lb: 5
    bfd: 0
    SetProtectState(True) success!
    Going to read encryption key...
    Encryption key read done!
    Encryption key: 510fb093 a3cbeadc 5993a17e c7adeb03
    Preparing to write data file to chip - resetting bus and baud...
    Getting bus... (now, please do reboot by CEN or by power off/on)
    Getting bus success!
    Going to set baud rate setting (460800)!
    Will try to read device flash MID (for unprotect N):
    Flash MID loaded: 1560EB
    Will now search for Flash def in out database...
    Flash def found! For: 1560EB
    Flash information: mid: 1560EB, icName: TH25Q16HB, manufacturer: TH, szMem: 1000000, szSR: 2, cwUnp: 0, cwEnp: 7, cwMsk: 407C, sb: 2, lb: 5, cwdRd: 05-35-FF-FF, cwdWr: 01-FF-FF-FF
    Entering SetProtectState(True)...
    sr: 0
    sr: 0
    final sr: 0
    msk: 407c
    cw: 0, sb: 2, lb: 5
    bfd: 0
    SetProtectState(True) success!
    Going to do erase, start 1904640, sec count 1!
    Erasing sector 1904640... ok! 
    All selected sectors erased!
    
    Now will also write OBK config...
    Long name from CFG: OpenBekenX_611393
    Short name from CFG: obk611393
    Web Root from CFG: https://openbekeniot.github.io/webapp/
    Writing config sector 0x1D1000...Writing file data to chip successs.
    


    Could anybody point me what I might be doing wrong?
  • #11 21692923
    p.kaczmarek2
    Moderator Smart Home
    Please check debug log at TX2 - baud 115200. Disconnect device from mains first. Power it from reliable 3.3V supply.
    Helpful post? Buy me a coffee.
  • #12 21692982
    jaboto
    Level 3  
    >>21692923

    Thanks for replying @p.kaczmarek2 .

    I have soldered a new terminal to TX2. I used pico to capture this:
    
    root@PlaneShift:/home/jaime/Projects/BK7231GUIFlashTool# picocom -b 115200 /dev/ttyUSB0 | tee pico.log
    picocom v3.1
    
    port is        : /dev/ttyUSB0
    flowcontrol    : none
    baudrate is    : 115200
    parity is      : none
    databits are   : 8
    stopbits are   : 1
    escape is      : C-a
    local echo is  : no
    noinit is      : no
    noreset is     : no
    hangup is      : no
    nolock is      : no
    send_cmd is    : sz -vv
    receive_cmd is : rz -vv -E
    imap is        : 
    omap is        : 
    emap is        : crcrlf,delbs,
    logfile is     : none
    initstring     : none
    exit_after is  : not set
    exit is        : no
    
    Type [C-a] [C-h] to see available commands
    Terminal ready
    ðü
    V:BK7231N_1.0.1
    REG:cpsr     spsr     r13      r14
    SVC:000000D3          00401C1C 000033AC
    IRQ:000000d2 00000010 00401e0c f1cfc8e9 
    FIR:000000d1 00000010 00401ffc 70332711 
    SYS:000000df          0040192c 00000158 
    ST:00000000
    J 0x10000
    bk_misc_init_start_type 0 0
    prvHeapInit-start addr:0x4144f0, size:113424
    [Flash]id:0xeb6015
    sctrl_sta_ps_init
    cset:0 0 0 0
    OpenBK7231N, version 1.18.175
    Entering initLog()...
    Commands registered!
    initLog() done!
    Inð
    Terminating...
    Thanks for using picocom
    


    You say to use a reliable 3.3v supply. I am using an old USB to serial I had laying around from my LoRaWan devices (see image) . You think that might be a problem?
    Heltec development board with micro USB port and pin headers on wooden desk
  • #13 21693050
    p.kaczmarek2
    Moderator Smart Home
    The log stops abtruptly without any visible errors. Did you try to just run it from mains (first disconnect usb to uart converter)?

    It may a be a power issue. I can't see any good LDO on your USB to UART converter. I am usually using AMS1117-3.3V. Have you seen my circuit on one of my videos?


    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #14 21693183
    jaboto
    Level 3  
    >>21693050 Yes, I have tried it running directly connected to the wall and still nothing.

    Unfortunately I don't have a 3.3 regulator. Will try to get another device and retry. Thanks in any case for your time
  • #16 21698658
    p.kaczmarek2
    Moderator Smart Home
    Hey, have you managed to flash it and get it running?
    Helpful post? Buy me a coffee.
  • #17 21698711
    jaboto
    Level 3  
    >>21698658
    Hey, @p.kaczmarek2 . Thanks for checking, actually I bought two more plugs and flashed and got them working quite quickly. The problem came from an issue with the PCB, it seems I am not the best at soldering and managed to desolder by mistake a diode which caused the device to not get enough power (I am assuming), therefore that faulty log. I guess that device is to be trashed.
  • #18 21698712
    p.kaczmarek2
    Moderator Smart Home
    Interesting, can you show a photo which diode exactly was desoldered? Maybe it's easy to recover.
    Helpful post? Buy me a coffee.
  • #19 21699802
    jaboto
    Level 3  
    >>21698712

    The D1 here seems to have fallen, i couldn't find it anywhere so maybe it was even a faulty device? Never tried before flashing. As a test I decided to solder together (that's the picture actually) and when I plugged it sparked so I guess it is burnt now. In any case, was a cheap device and was a good testing of my soldering skills. Now I have 3 working :)
    Close-up of damaged D1 diode on green PCB, highlighted with a red circle

    Thanks!
  • #20 21699821
    p.kaczmarek2
    Moderator Smart Home
    I would need to see a bit more, where exactly is it located. What is the marking of power supply chip? Is it the famous BP2525?
    Typical BP2525X application circuit with AC input and DC output

    Well, it sparked, but maybe CB2S is still alive? You can easily desolder it and use for some DIY project or testing. You just need a good 3.3V power supply. You can use this CB2S like a "Beken" Arduino for DIY projects.
    Helpful post? Buy me a coffee.
📢 Listen (AI):

Topic summary

The discussion revolves around the LSC SmartPlug model 3202087, which features a Beken BKN7231N chip and a PCB labeled WP02GE-F from August 4, 2023. Users share insights on the device's construction, noting the transition from ESP826x-based plugs to Beken chips. A teardown and flashing guide for OpenBeken firmware is provided, with advice on handling the device's PowerSave feature, particularly with the BL0937 energy meter chip. Users report successful firmware uploads but encounter issues with OTA updates, specifically with version changes not being recognized. Detailed steps for performing OTA updates are shared, including file selection processes.
Summary generated by the language model.
ADVERTISEMENT